- fixed use after free #2499

2 files changed, 3 insertions, 2 deletions

diff --git a/src/dht/dht_api.c b/src/dht/dht_api.c
index cce9f8b8c..46436755b 100644
--- a/src/dht/dht_api.c
+++ b/src/dht/dht_api.c
@@ -881,8 +881,8 @@ service_message_handler (void *cls, const struct GNUNET_MessageHeader *msg)
   default:
     GNUNET_break(0);
     LOG (GNUNET_ERROR_TYPE_WARNING,
-         "Unknown DHT message type: %hu\n",
-         ntohs (msg->type));
+         "Unknown DHT message type: %hu (%hu) size: %hu\n",
+         ntohs (msg->type), msg->type, msize);
     break;
   }
   if (GNUNET_OK != ret)
diff --git a/src/dht/gnunet-service-dht_clients.c b/src/dht/gnunet-service-dht_clients.c
index 173a1c3ef..a67155b89 100644
--- a/src/dht/gnunet-service-dht_clients.c
+++ b/src/dht/gnunet-service-dht_clients.c
@@ -984,6 +984,7 @@ forward_reply (void *cls, const struct GNUNET_HashCode * key, void *value)
     memcpy (pm, frc->pm,
             sizeof (struct PendingMessage) + ntohs (frc->pm->msg->size));
     pm->next = pm->prev = NULL;
+    pm->msg = (struct GNUNET_MessageHeader *) &pm[1];
   }
   GNUNET_STATISTICS_update (GDS_stats,
                             gettext_noop ("# RESULTS queued for clients"), 1,